@serve.zone/interfaces 16.7.0 → 17.0.0

package/changelog.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 2026-07-21 - 17.0.0
+
+### Breaking Changes
+
+- make gateway-client credential handover explicitly two-phase (gateway)
+  - Provisioning now returns an unfinalized candidate credential without revoking existing credentials.
+  - Add candidate-authenticated finalization to activate credentials and revoke superseded client-bound credentials.
+  - Remove caller-selected gateway client finalization and provisioning-time revocation counts from the gateway API contract.
+
+## 2026-07-21 - 16.8.0
+
+### Features
+
+- add explicit gateway-route DNS modes, reconciliation outcomes, replaced-record evidence, and deployment verification retry metadata
+- add canonical gateway-client policy, provisioning credential, and mail-overview contracts
+- remove the legacy dedicated dcrouter ops-token setting from the Cloudly settings contract
+
 ## 2026-07-21 - 16.7.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '16.7.0',
+    version: '17.0.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/deploymentoperation.d.ts

@@ -1,4 +1,5 @@
 import type { IDeploymentPreflightProposedConfiguration, IDeploymentPreflightRuntimeTask } from './deploymentpreflight.js';
+import type { IGatewayRouteDnsResult } from './gateway.js';
 import type { IImageRolloutStatus, IImmutableImageDeploymentPlan, TSha256Digest } from './immutableimage.js';
 import type { IRegistryTarget } from './registry.js';
 import type { TServiceTargetPortRef } from './serviceports.js';
@@ -58,6 +59,9 @@ interface IDeploymentRouteVerificationEvidenceBase {
     rolloutId: string;
     rolloutGeneration: number;
     expectedDigest: TSha256Digest;
+    gatewayDns?: IGatewayRouteDnsResult;
+    verificationAttemptCount?: number;
+    verificationStartedAt?: number;
 }
 export interface IDeploymentRouteVerificationSuccessEvidence extends IDeploymentRouteVerificationEvidenceBase {
     outcome: 'succeeded';

package/dist_ts/data/deploymentoperation.js

@@ -226,4 +226,4 @@ export const validateDeploymentReservationInput = (inputArg) => {
     }
     return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudG9wZXJhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZGVwbG95bWVudG9wZXJhdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUUxRixPQUFPLEVBQUUsNEJBQTRCLEVBQUUsNEJBQTRCLEVBQUUsMEJBQTBCLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFxRXRILE1BQU0sc0JBQXNCLEdBQUcsNEZBQTRGLENBQUM7QUFFNUgsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FBQyxXQUFvQixFQUFzQixFQUFFO0lBQ3pGLElBQUksT0FBTyxXQUFXLEtBQUssUUFBUTtRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQ3RELE1BQU0sUUFBUSxHQUFHLFdBQVcsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ3JFLE9BQU8sUUFBUSxDQUFDLE1BQU0sSUFBSSxHQUFHLElBQUksc0JBQXNCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQztRQUNwRSxDQUFDLENBQUMsUUFBUTtRQUNWLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsQ0FDM0MsV0FBbUIsRUFDc0IsRUFBRTtJQUMzQyxNQUFNLFFBQVEsR0FBRyw4QkFBOEIsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUM3RCxJQUFJLENBQUMsUUFBUTtRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQ2hDLE1BQU0sUUFBUSxHQUFHLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDM0MsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNwRSxNQUFNLGNBQWMsR0FBRyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQy9FLElBQUksQ0FBQyxjQUFjLElBQUksQ0FBQyxRQUFRLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUN6RSxPQUFPLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxRQUFRLEVBQUUsQ0FBQztBQUNoRCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxDQUNwRCxRQUFpQyxFQUNiLEVBQUU7SUFDdEIsTUFBTSxNQUFNLEdBQUcsNkJBQTZCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2hFLElBQUksQ0FBQyxNQUFNO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDOUIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNyQixPQUFPLFFBQVEsQ0FBQyxvQkFBb0IsS0FBSyxTQUFTO2VBQzdDLFFBQVEsQ0FBQyxvQkFBb0IsS0FBSyxNQUFNLENBQUMsUUFBUTtZQUNwRCxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVE7WUFDakIsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxvQkFBb0I7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUNyRCxNQUFNLGtCQUFrQixHQUFHLDZCQUE2QixDQUFDLFFBQVEsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3hGLE9BQU8sa0JBQWtCO1dBQ3BCLENBQUMsa0JBQWtCLENBQUMsUUFBUTtXQUM1QixrQkFBa0IsQ0FBQyxjQUFjLEtBQUssTUFBTSxDQUFDLGNBQWM7UUFDOUQsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLFFBQVE7UUFDN0IsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxDQUFDLE9BQWlCLEVBQXNCLEVBQUU7SUFDeEYsSUFBSSxPQUFPLEtBQUssU0FBUyxJQUFJLE9BQU8sT0FBTyxLQUFLLFFBQVE7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUMzRSxNQUFNLElBQUksR0FBRyxPQUFPLElBQUksR0FBRyxDQUFDO0lBQzVCLE9BQU8sbURBQW1ELENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQztRQUNuRSxDQUFDLENBQUMsSUFBSTtRQUNOLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSx5QkFBeUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUN4RSxNQUFNLG9CQUFvQixHQUFHLGdCQUFnQixDQUFDO0FBQzlDLE1BQU0sb0JBQW9CLEdBQUcsNE1BQTRNLENBQUM7QUFFMU8sTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUF1QyxFQUFFLENBQUMsQ0FDM0UsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQzlFLENBQUM7QUFFRixNQUFNLG1CQUFtQixHQUFHLENBQzFCLFFBQWlCLEVBQ2pCLFdBQW1CLEVBQ25CLFlBQTJDLEVBQ3JCLEVBQUUsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztPQUM3QyxRQUFRLENBQUMsTUFBTSxJQUFJLFdBQVc7T0FDOUIsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxPQUFPLEtBQUssUUFBUTtXQUNyRCxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDbEIsT0FBTyxDQUFDLE1BQU0sSUFBSSxHQUFHO1dBQ3JCLFlBQVksQ0FBQyxPQUFPLENBQUMsQ0FBQztPQUN4QixJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLE1BQU0sQ0FBQztBQUVoRCxNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxDQUNyRCxnQkFBeUIsRUFDZixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQztRQUFFLE9BQU8sQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ3BGLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLGdCQUFnQixDQUFDLGFBQWEsS0FBSyxDQUFDO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2pGLElBQUksT0FBTyxnQkFBZ0IsQ0FBQyxtQkFBbUIsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLHFDQUFxQyxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUNELElBQUksT0FBTyxnQkFBZ0IsQ0FBQyxXQUFXLEtBQUssUUFBUTtXQUMvQyxDQUFDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUU7V0FDcEMsZ0JBQWdCLENBQUMsV0FBVyxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUMvQyxNQUFNLENBQUMsSUFBSSxDQUFDLDJDQUEyQyxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxnQkFBZ0IsQ0FBQyxlQUFlLEVBQUUsQ0FBQyxFQUFFLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUM3RSw4Q0FBOEMsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQ2pFLENBQUMsRUFBRSxDQUFDO1FBQ0gsTUFBTSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsZ0JBQWdCLENBQUMsYUFBYSxFQUFFLEVBQUUsRUFBRSxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsQ0FDMUUsOEJBQThCLENBQUMsU0FBUyxDQUFDLEtBQUssU0FBUyxDQUN4RCxDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsSUFBSSxDQUFDLG1CQUFtQixDQUFDLGdCQUFnQixDQUFDLHdCQUF3QixFQUFFLEdBQUcsRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsQ0FDcEYsT0FBTyxDQUFDLE1BQU0sSUFBSSxHQUFHLElBQUksb0JBQW9CLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUM1RCxDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLG1CQUFtQixDQUFDLGdCQUFnQixDQUFDLGtCQUFrQixFQUFFLEVBQUUsRUFBRSxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FDM0UsS0FBSyxDQUFDLE1BQU0sSUFBSSxHQUFHLElBQUksK0JBQStCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUNuRSxDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsTUFBTSxnQkFBZ0IsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLFlBQVksQ0FBQztRQUNuRSxDQUFDLENBQUMsZ0JBQWdCLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDcEQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQ3pGLENBQUM7UUFDRixDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLDRCQUE0QixDQUFDLGdCQUFnQixDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDN0UsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLDBCQUEwQixDQUFDLGdCQUFnQixDQUFDLFdBQVcsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7SUFDM0YsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQztXQUMxQyxLQUFLLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLHdCQUF3QixDQUFDLEVBQUUsQ0FBQztRQUM5RCxNQUFNLHNCQUFzQixHQUFHLElBQUksR0FBRyxDQUNwQyxnQkFBZ0IsQ0FBQyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLEVBQXFCLEVBQUUsQ0FBQyxDQUMvRSxPQUFPLE9BQU8sS0FBSyxRQUFRLENBQzVCLENBQUMsQ0FDSCxDQUFDO1FBQ0YsSUFBSSxnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUNqRCxRQUFRLENBQUMsT0FBTyxDQUFDO2VBQ2QsT0FBTyxPQUFPLENBQUMsU0FBUyxLQUFLLFFBQVE7ZUFDckMsc0JBQXNCLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FDakQsQ0FBQyxFQUFFLENBQUM7WUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLHVFQUF1RSxDQUFDLENBQUM7UUFDdkYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxjQUFjLENBQUM7V0FDOUMsZ0JBQWdCLENBQUMsY0FBYyxDQUFDLE1BQU0sR0FBRyxFQUFFO1dBQzNDLGdCQUFnQixDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUM7ZUFDOUUsT0FBTyxHQUFHLENBQUMsSUFBSSxPQUFPLEdBQUcsS0FBSyxDQUFDO1dBQ2pDLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLGNBQWMsQ0FBQyxDQUFDLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxjQUFjLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDOUYsTUFBTSxDQUFDLElBQUksQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxZQUFZLENBQUM7V0FDNUMsZ0JBQWdCLENBQUMsWUFBWSxDQUFDLE1BQU0sR0FBRyxFQUFFO1dBQ3pDLGdCQUFnQixDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztlQUNsRSxPQUFPLFFBQVEsQ0FBQyxTQUFTLEtBQUssUUFBUTtlQUN0QyxDQUFDLDRCQUE0QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO2VBQ3RELDRCQUE0QixDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsS0FBSyxRQUFRLENBQUMsU0FBUztlQUN2RSxDQUFDLFFBQVEsQ0FBQyxZQUFZLEtBQUssV0FBVyxJQUFJLFFBQVEsQ0FBQyxZQUFZLEtBQUssV0FBVyxDQUFDO2VBQ2hGLENBQUMsUUFBUSxDQUFDLFVBQVUsS0FBSyxTQUFTO21CQUNoQyxRQUFRLENBQUMsVUFBVSxLQUFLLFVBQVU7bUJBQ2xDLFFBQVEsQ0FBQyxVQUFVLEtBQUssZUFBZSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsb0JBQW9CLENBQUM7V0FDcEQsZ0JBQWdCLENBQUMsb0JBQW9CLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDaEQsZ0JBQWdCLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLENBQUMsYUFBYSxFQUFFLEVBQUUsQ0FBQyxDQUMvRCxhQUFhLEtBQUssVUFBVSxJQUFJLGFBQWEsS0FBSyxlQUFlLENBQ2xFLENBQUM7V0FDQyxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDLElBQUk7Z0JBQ2hELGdCQUFnQixDQUFDLG9CQUFvQixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3JELE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsQ0FBQyxRQUFpQixFQUFZLEVBQUU7SUFDaEYsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7UUFBRSxPQUFPLENBQUMscUNBQXFDLENBQUMsQ0FBQztJQUN4RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLGtCQUFrQixJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxLQUFLLE1BQU0sS0FBSyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixDQUFVLEVBQUUsQ0FBQztRQUMvRSxJQUFJLE9BQU8sUUFBUSxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVE7ZUFDbEMsQ0FBQyx5QkFBeUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBVyxDQUFDLEVBQUUsQ0FBQztZQUNoRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyx5Q0FBeUMsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFFBQVEsQ0FBQyxjQUFjLEtBQUssUUFBUTtXQUMxQyxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUN6RCxNQUFNLENBQUMsSUFBSSxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsT0FBTyxLQUFLLFFBQVEsSUFBSSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUN6RixNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUNsRCxNQUFNLENBQUMsSUFBSSxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELElBQUksQ0FBQyw0QkFBNEIsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUN2RCxNQUFNLENBQUMsSUFBSSxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDbkUsQ0FBQztJQUNELE1BQU0sYUFBYSxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMscUJBQXFCLENBQUM7UUFDNUQsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxxQkFBcUI7UUFDaEMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNkLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyx1Q0FBdUMsQ0FBQyxRQUFRLENBQUMscUJBQXFCLENBQUMsQ0FBQyxDQUFDO0lBQ3hGLE1BQU0sY0FBYyxHQUFHLGFBQWEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxjQUFjLENBQUM7UUFDakYsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxjQUFjO1FBQzlCLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDZCxNQUFNLGFBQWEsR0FBRyxhQUFhLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsYUFBYSxDQUFDO1FBQy9FLENBQUMsQ0FBQyxhQUFhLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFNBQVMsRUFBdUIsRUFBRSxDQUFDLENBQ3ZFLE9BQU8sU0FBUyxLQUFLLFFBQVEsQ0FDOUIsQ0FBQztRQUNGLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDZCxJQUFJLGFBQWEsRUFBRSxtQkFBbUIsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUNoRCxNQUFNLENBQUMsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDNUUsTUFBTSxjQUFjLEdBQUcsTUFBTSxFQUFFLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDL0MsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FDNUYsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxDQUFDLE1BQU07V0FDTixNQUFNLENBQUMsTUFBTSxHQUFHLEVBQUU7V0FDbEIsQ0FBQyxjQUFjO1dBQ2YsSUFBSSxHQUFHLENBQUMsY0FBYyxDQUFDLENBQUMsSUFBSSxLQUFLLGNBQWMsQ0FBQyxNQUFNO1dBQ3RELE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRTtZQUMxQixJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQzttQkFDbEIsT0FBTyxRQUFRLENBQUMsUUFBUSxLQUFLLFFBQVE7bUJBQ3JDLDhCQUE4QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsS0FBSyxRQUFRLENBQUMsUUFBUTttQkFDdkUsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7bUJBQ3pDLFFBQVEsQ0FBQyxVQUFxQixHQUFHLENBQUM7bUJBQ2xDLFFBQVEsQ0FBQyxVQUFxQixHQUFHLEtBQUs7bUJBQ3ZDLENBQUMsY0FBYyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztnQkFDcEQsT0FBTyxJQUFJLENBQUM7WUFDZCxDQUFDO1lBQ0QsTUFBTSxVQUFVLEdBQUcsUUFBOEMsQ0FBQztZQUNsRSxPQUFPLHNDQUFzQyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVM7bUJBQ2xFLENBQUMsUUFBUSxDQUFDLGFBQWEsS0FBSyxTQUFTO3VCQUNuQyxDQUFDLE9BQU8sUUFBUSxDQUFDLGFBQWEsS0FBSyxRQUFROzJCQUN6QyxnQ0FBZ0MsQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDLEtBQUssUUFBUSxDQUFDLGFBQWEsQ0FBQyxDQUFDO21CQUN6RixDQUFDLFFBQVEsQ0FBQyxtQkFBbUIsS0FBSyxTQUFTO3VCQUN6QyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsbUJBQW1CLENBQUM7MkJBQzNDLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQzsyQkFDdkMsUUFBUSxDQUFDLG1CQUFtQixDQUFDLE1BQU0sR0FBRyxFQUFFOzJCQUN4QyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsbUJBQW1CLENBQUMsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLG1CQUFtQixDQUFDLE1BQU07MkJBQ2xGLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUM7K0JBQy9FLFNBQVMsR0FBRyxHQUFHLElBQUksU0FBUyxHQUFHLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNuRCxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ0wsTUFBTSxDQUFDLElBQUksQ0FBQywwRUFBMEUsQ0FBQyxDQUFDO0lBQzFGLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDbkMsSUFBSSxRQUFRLENBQUMseUJBQXlCLEtBQUssU0FBUztlQUMvQyxRQUFRLENBQUMsd0JBQXdCLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDckQsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO1FBQ2pGLENBQUM7UUFDRCxJQUFJLGFBQWEsSUFBSSxjQUFjLEVBQUUsQ0FBQztZQUNwQyxNQUFNLFFBQVEsR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNwRCxNQUFNLE1BQU0sR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBc0IsRUFBRSxDQUFDLENBQ2pGLE9BQU8sUUFBUSxLQUFLLFFBQVEsQ0FDN0IsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNaLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7Z0JBQ3hELE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztZQUM3RSxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssa0JBQWtCLEVBQUUsQ0FBQztRQUN6QyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMseUJBQXlCLENBQUM7ZUFDdkQsUUFBUSxDQUFDLHlCQUFvQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3hELE1BQU0sQ0FBQyxJQUFJLENBQUMsNEVBQTRFLENBQUMsQ0FBQztRQUM1RixDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsd0JBQXdCLEtBQUssU0FBUztlQUM5QyxDQUFDLE9BQU8sUUFBUSxDQUFDLHdCQUF3QixLQUFLLFFBQVE7bUJBQ3BELENBQUMseUJBQXlCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLGlFQUFpRSxDQUFDLENBQUM7UUFDakYsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudG9wZXJhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZGVwbG95bWVudG9wZXJhdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFHQSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUUxRixPQUFPLEVBQUUsNEJBQTRCLEVBQUUsNEJBQTRCLEVBQUUsMEJBQTBCLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFxRXRILE1BQU0sc0JBQXNCLEdBQUcsNEZBQTRGLENBQUM7QUFFNUgsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FBQyxXQUFvQixFQUFzQixFQUFFO0lBQ3pGLElBQUksT0FBTyxXQUFXLEtBQUssUUFBUTtRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQ3RELE1BQU0sUUFBUSxHQUFHLFdBQVcsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ3JFLE9BQU8sUUFBUSxDQUFDLE1BQU0sSUFBSSxHQUFHLElBQUksc0JBQXNCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQztRQUNwRSxDQUFDLENBQUMsUUFBUTtRQUNWLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsQ0FDM0MsV0FBbUIsRUFDc0IsRUFBRTtJQUMzQyxNQUFNLFFBQVEsR0FBRyw4QkFBOEIsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUM3RCxJQUFJLENBQUMsUUFBUTtRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQ2hDLE1BQU0sUUFBUSxHQUFHLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDM0MsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNwRSxNQUFNLGNBQWMsR0FBRyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQy9FLElBQUksQ0FBQyxjQUFjLElBQUksQ0FBQyxRQUFRLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUN6RSxPQUFPLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxRQUFRLEVBQUUsQ0FBQztBQUNoRCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxDQUNwRCxRQUFpQyxFQUNiLEVBQUU7SUFDdEIsTUFBTSxNQUFNLEdBQUcsNkJBQTZCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2hFLElBQUksQ0FBQyxNQUFNO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDOUIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNyQixPQUFPLFFBQVEsQ0FBQyxvQkFBb0IsS0FBSyxTQUFTO2VBQzdDLFFBQVEsQ0FBQyxvQkFBb0IsS0FBSyxNQUFNLENBQUMsUUFBUTtZQUNwRCxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVE7WUFDakIsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxvQkFBb0I7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUNyRCxNQUFNLGtCQUFrQixHQUFHLDZCQUE2QixDQUFDLFFBQVEsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3hGLE9BQU8sa0JBQWtCO1dBQ3BCLENBQUMsa0JBQWtCLENBQUMsUUFBUTtXQUM1QixrQkFBa0IsQ0FBQyxjQUFjLEtBQUssTUFBTSxDQUFDLGNBQWM7UUFDOUQsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLFFBQVE7UUFDN0IsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxDQUFDLE9BQWlCLEVBQXNCLEVBQUU7SUFDeEYsSUFBSSxPQUFPLEtBQUssU0FBUyxJQUFJLE9BQU8sT0FBTyxLQUFLLFFBQVE7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUMzRSxNQUFNLElBQUksR0FBRyxPQUFPLElBQUksR0FBRyxDQUFDO0lBQzVCLE9BQU8sbURBQW1ELENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQztRQUNuRSxDQUFDLENBQUMsSUFBSTtRQUNOLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSx5QkFBeUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUN4RSxNQUFNLG9CQUFvQixHQUFHLGdCQUFnQixDQUFDO0FBQzlDLE1BQU0sb0JBQW9CLEdBQUcsNE1BQTRNLENBQUM7QUFFMU8sTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUF1QyxFQUFFLENBQUMsQ0FDM0UsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQzlFLENBQUM7QUFFRixNQUFNLG1CQUFtQixHQUFHLENBQzFCLFFBQWlCLEVBQ2pCLFdBQW1CLEVBQ25CLFlBQTJDLEVBQ3JCLEVBQUUsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztPQUM3QyxRQUFRLENBQUMsTUFBTSxJQUFJLFdBQVc7T0FDOUIsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxPQUFPLEtBQUssUUFBUTtXQUNyRCxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDbEIsT0FBTyxDQUFDLE1BQU0sSUFBSSxHQUFHO1dBQ3JCLFlBQVksQ0FBQyxPQUFPLENBQUMsQ0FBQztPQUN4QixJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLE1BQU0sQ0FBQztBQUVoRCxNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxDQUNyRCxnQkFBeUIsRUFDZixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQztRQUFFLE9BQU8sQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ3BGLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLGdCQUFnQixDQUFDLGFBQWEsS0FBSyxDQUFDO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2pGLElBQUksT0FBTyxnQkFBZ0IsQ0FBQyxtQkFBbUIsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLHFDQUFxQyxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUNELElBQUksT0FBTyxnQkFBZ0IsQ0FBQyxXQUFXLEtBQUssUUFBUTtXQUMvQyxDQUFDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUU7V0FDcEMsZ0JBQWdCLENBQUMsV0FBVyxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUMvQyxNQUFNLENBQUMsSUFBSSxDQUFDLDJDQUEyQyxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxnQkFBZ0IsQ0FBQyxlQUFlLEVBQUUsQ0FBQyxFQUFFLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUM3RSw4Q0FBOEMsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQ2pFLENBQUMsRUFBRSxDQUFDO1FBQ0gsTUFBTSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsZ0JBQWdCLENBQUMsYUFBYSxFQUFFLEVBQUUsRUFBRSxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsQ0FDMUUsOEJBQThCLENBQUMsU0FBUyxDQUFDLEtBQUssU0FBUyxDQUN4RCxDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsSUFBSSxDQUFDLG1CQUFtQixDQUFDLGdCQUFnQixDQUFDLHdCQUF3QixFQUFFLEdBQUcsRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsQ0FDcEYsT0FBTyxDQUFDLE1BQU0sSUFBSSxHQUFHLElBQUksb0JBQW9CLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUM1RCxDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLG1CQUFtQixDQUFDLGdCQUFnQixDQUFDLGtCQUFrQixFQUFFLEVBQUUsRUFBRSxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FDM0UsS0FBSyxDQUFDLE1BQU0sSUFBSSxHQUFHLElBQUksK0JBQStCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUNuRSxDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsTUFBTSxnQkFBZ0IsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLFlBQVksQ0FBQztRQUNuRSxDQUFDLENBQUMsZ0JBQWdCLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDcEQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQ3pGLENBQUM7UUFDRixDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLDRCQUE0QixDQUFDLGdCQUFnQixDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDN0UsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLDBCQUEwQixDQUFDLGdCQUFnQixDQUFDLFdBQVcsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7SUFDM0YsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQztXQUMxQyxLQUFLLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLHdCQUF3QixDQUFDLEVBQUUsQ0FBQztRQUM5RCxNQUFNLHNCQUFzQixHQUFHLElBQUksR0FBRyxDQUNwQyxnQkFBZ0IsQ0FBQyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLEVBQXFCLEVBQUUsQ0FBQyxDQUMvRSxPQUFPLE9BQU8sS0FBSyxRQUFRLENBQzVCLENBQUMsQ0FDSCxDQUFDO1FBQ0YsSUFBSSxnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUNqRCxRQUFRLENBQUMsT0FBTyxDQUFDO2VBQ2QsT0FBTyxPQUFPLENBQUMsU0FBUyxLQUFLLFFBQVE7ZUFDckMsc0JBQXNCLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FDakQsQ0FBQyxFQUFFLENBQUM7WUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLHVFQUF1RSxDQUFDLENBQUM7UUFDdkYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxjQUFjLENBQUM7V0FDOUMsZ0JBQWdCLENBQUMsY0FBYyxDQUFDLE1BQU0sR0FBRyxFQUFFO1dBQzNDLGdCQUFnQixDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUM7ZUFDOUUsT0FBTyxHQUFHLENBQUMsSUFBSSxPQUFPLEdBQUcsS0FBSyxDQUFDO1dBQ2pDLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLGNBQWMsQ0FBQyxDQUFDLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxjQUFjLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDOUYsTUFBTSxDQUFDLElBQUksQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxZQUFZLENBQUM7V0FDNUMsZ0JBQWdCLENBQUMsWUFBWSxDQUFDLE1BQU0sR0FBRyxFQUFFO1dBQ3pDLGdCQUFnQixDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztlQUNsRSxPQUFPLFFBQVEsQ0FBQyxTQUFTLEtBQUssUUFBUTtlQUN0QyxDQUFDLDRCQUE0QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO2VBQ3RELDRCQUE0QixDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsS0FBSyxRQUFRLENBQUMsU0FBUztlQUN2RSxDQUFDLFFBQVEsQ0FBQyxZQUFZLEtBQUssV0FBVyxJQUFJLFFBQVEsQ0FBQyxZQUFZLEtBQUssV0FBVyxDQUFDO2VBQ2hGLENBQUMsUUFBUSxDQUFDLFVBQVUsS0FBSyxTQUFTO21CQUNoQyxRQUFRLENBQUMsVUFBVSxLQUFLLFVBQVU7bUJBQ2xDLFFBQVEsQ0FBQyxVQUFVLEtBQUssZUFBZSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsb0JBQW9CLENBQUM7V0FDcEQsZ0JBQWdCLENBQUMsb0JBQW9CLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDaEQsZ0JBQWdCLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLENBQUMsYUFBYSxFQUFFLEVBQUUsQ0FBQyxDQUMvRCxhQUFhLEtBQUssVUFBVSxJQUFJLGFBQWEsS0FBSyxlQUFlLENBQ2xFLENBQUM7V0FDQyxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDLElBQUk7Z0JBQ2hELGdCQUFnQixDQUFDLG9CQUFvQixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3JELE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsQ0FBQyxRQUFpQixFQUFZLEVBQUU7SUFDaEYsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7UUFBRSxPQUFPLENBQUMscUNBQXFDLENBQUMsQ0FBQztJQUN4RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLGtCQUFrQixJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxLQUFLLE1BQU0sS0FBSyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixDQUFVLEVBQUUsQ0FBQztRQUMvRSxJQUFJLE9BQU8sUUFBUSxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVE7ZUFDbEMsQ0FBQyx5QkFBeUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBVyxDQUFDLEVBQUUsQ0FBQztZQUNoRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyx5Q0FBeUMsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFFBQVEsQ0FBQyxjQUFjLEtBQUssUUFBUTtXQUMxQyxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUN6RCxNQUFNLENBQUMsSUFBSSxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsT0FBTyxLQUFLLFFBQVEsSUFBSSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUN6RixNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUNsRCxNQUFNLENBQUMsSUFBSSxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELElBQUksQ0FBQyw0QkFBNEIsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUN2RCxNQUFNLENBQUMsSUFBSSxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDbkUsQ0FBQztJQUNELE1BQU0sYUFBYSxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMscUJBQXFCLENBQUM7UUFDNUQsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxxQkFBcUI7UUFDaEMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNkLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyx1Q0FBdUMsQ0FBQyxRQUFRLENBQUMscUJBQXFCLENBQUMsQ0FBQyxDQUFDO0lBQ3hGLE1BQU0sY0FBYyxHQUFHLGFBQWEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxjQUFjLENBQUM7UUFDakYsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxjQUFjO1FBQzlCLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDZCxNQUFNLGFBQWEsR0FBRyxhQUFhLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsYUFBYSxDQUFDO1FBQy9FLENBQUMsQ0FBQyxhQUFhLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFNBQVMsRUFBdUIsRUFBRSxDQUFDLENBQ3ZFLE9BQU8sU0FBUyxLQUFLLFFBQVEsQ0FDOUIsQ0FBQztRQUNGLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDZCxJQUFJLGFBQWEsRUFBRSxtQkFBbUIsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUNoRCxNQUFNLENBQUMsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDNUUsTUFBTSxjQUFjLEdBQUcsTUFBTSxFQUFFLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDL0MsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FDNUYsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxDQUFDLE1BQU07V0FDTixNQUFNLENBQUMsTUFBTSxHQUFHLEVBQUU7V0FDbEIsQ0FBQyxjQUFjO1dBQ2YsSUFBSSxHQUFHLENBQUMsY0FBYyxDQUFDLENBQUMsSUFBSSxLQUFLLGNBQWMsQ0FBQyxNQUFNO1dBQ3RELE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRTtZQUMxQixJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQzttQkFDbEIsT0FBTyxRQUFRLENBQUMsUUFBUSxLQUFLLFFBQVE7bUJBQ3JDLDhCQUE4QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsS0FBSyxRQUFRLENBQUMsUUFBUTttQkFDdkUsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7bUJBQ3pDLFFBQVEsQ0FBQyxVQUFxQixHQUFHLENBQUM7bUJBQ2xDLFFBQVEsQ0FBQyxVQUFxQixHQUFHLEtBQUs7bUJBQ3ZDLENBQUMsY0FBYyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztnQkFDcEQsT0FBTyxJQUFJLENBQUM7WUFDZCxDQUFDO1lBQ0QsTUFBTSxVQUFVLEdBQUcsUUFBOEMsQ0FBQztZQUNsRSxPQUFPLHNDQUFzQyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVM7bUJBQ2xFLENBQUMsUUFBUSxDQUFDLGFBQWEsS0FBSyxTQUFTO3VCQUNuQyxDQUFDLE9BQU8sUUFBUSxDQUFDLGFBQWEsS0FBSyxRQUFROzJCQUN6QyxnQ0FBZ0MsQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDLEtBQUssUUFBUSxDQUFDLGFBQWEsQ0FBQyxDQUFDO21CQUN6RixDQUFDLFFBQVEsQ0FBQyxtQkFBbUIsS0FBSyxTQUFTO3VCQUN6QyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsbUJBQW1CLENBQUM7MkJBQzNDLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQzsyQkFDdkMsUUFBUSxDQUFDLG1CQUFtQixDQUFDLE1BQU0sR0FBRyxFQUFFOzJCQUN4QyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsbUJBQW1CLENBQUMsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLG1CQUFtQixDQUFDLE1BQU07MkJBQ2xGLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUM7K0JBQy9FLFNBQVMsR0FBRyxHQUFHLElBQUksU0FBUyxHQUFHLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNuRCxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ0wsTUFBTSxDQUFDLElBQUksQ0FBQywwRUFBMEUsQ0FBQyxDQUFDO0lBQzFGLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDbkMsSUFBSSxRQUFRLENBQUMseUJBQXlCLEtBQUssU0FBUztlQUMvQyxRQUFRLENBQUMsd0JBQXdCLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDckQsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO1FBQ2pGLENBQUM7UUFDRCxJQUFJLGFBQWEsSUFBSSxjQUFjLEVBQUUsQ0FBQztZQUNwQyxNQUFNLFFBQVEsR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNwRCxNQUFNLE1BQU0sR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBc0IsRUFBRSxDQUFDLENBQ2pGLE9BQU8sUUFBUSxLQUFLLFFBQVEsQ0FDN0IsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNaLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7Z0JBQ3hELE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztZQUM3RSxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssa0JBQWtCLEVBQUUsQ0FBQztRQUN6QyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMseUJBQXlCLENBQUM7ZUFDdkQsUUFBUSxDQUFDLHlCQUFvQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3hELE1BQU0sQ0FBQyxJQUFJLENBQUMsNEVBQTRFLENBQUMsQ0FBQztRQUM1RixDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsd0JBQXdCLEtBQUssU0FBUztlQUM5QyxDQUFDLE9BQU8sUUFBUSxDQUFDLHdCQUF3QixLQUFLLFFBQVE7bUJBQ3BELENBQUMseUJBQXlCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLGlFQUFpRSxDQUFDLENBQUM7UUFDakYsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts/data/gateway.d.ts

@@ -7,6 +7,55 @@ export type TGatewayClientType = 'onebox' | 'cloudly' | 'custom';
  * Canonical managed route purposes understood by gateways.
  */
 export type TManagedRouteKind = 'letsencrypt-http01-forward';
+/**
+ * DNS handling requested alongside a gateway route synchronization.
+ *
+ * - 'reconcile' claims or replaces exact-host manual A, AAAA, and CNAME
+ *   records, including already-correct records, with gateway-managed state.
+ * - 'observe' reports DNS state without mutating it.
+ * - 'skip' bypasses DNS inspection and mutation and is the default when omitted.
+ */
+export type TGatewayRouteDnsMode = 'reconcile' | 'observe' | 'skip';
+/**
+ * Detailed DNS outcome reported by a gateway route synchronization.
+ */
+export type TGatewayRouteDnsStatus = 'not-applicable' | 'skipped' | 'managed-created' | 'managed-updated' | 'managed-overwrote-manual' | 'managed-unchanged' | 'observed-satisfied' | 'managed-deleted' | 'managed-orphan-deleted' | 'record-missing' | 'target-invalid' | 'zone-unmanaged' | 'zone-unavailable' | 'record-conflict' | 'mutation-failed' | 'compensation-failed';
+/**
+ * DNS record evidence attached to a gateway route synchronization result.
+ */
+export interface IGatewayRouteDnsRecord {
+    id?: string;
+    type: 'A' | 'AAAA' | 'CNAME';
+    name: string;
+    value: string;
+    ttl: number;
+    proxied?: boolean;
+    managed: boolean;
+}
+/**
+ * DNS reconciliation or observation result for a gateway route.
+ */
+export interface IGatewayRouteDnsResult {
+    success: boolean;
+    retryable: boolean;
+    mode: TGatewayRouteDnsMode;
+    status: TGatewayRouteDnsStatus;
+    hostname?: string;
+    targetIp?: string;
+    /** Desired gateway-managed address record type. CNAME appears only in record evidence. */
+    recordType?: 'A' | 'AAAA';
+    zoneId?: string;
+    zoneName?: string;
+    nameservers?: string[];
+    records?: IGatewayRouteDnsRecord[];
+    /** Prior manual records replaced by this reconciliation, preserved as evidence. */
+    overwrittenRecords?: IGatewayRouteDnsRecord[];
+    /** Time at which the gateway checked the DNS state, as Unix epoch milliseconds. */
+    checkedAt: number;
+    /** Time at which authoritative DNS verified the desired state, as Unix epoch milliseconds. */
+    authoritativeVerifiedAt?: number;
+    message?: string;
+}
 /**
  * Identity attached to gateway requests. Gateways run their own user/auth
  * domain (e.g. dcrouter operator accounts), so role/type stay open strings;
@@ -64,8 +113,12 @@ export interface IGatewayCapabilities {
 export interface IGatewayTokenCapabilities {
     readDomains?: boolean;
     readDnsRecords?: boolean;
+    readRoutes?: boolean;
     syncRoutes?: boolean;
     syncDnsRecords?: boolean;
+    readMail?: boolean;
+    manageMail?: boolean;
+    readCertificates?: boolean;
     requestCertificates?: boolean;
 }
 /**
@@ -74,22 +127,84 @@ export interface IGatewayTokenCapabilities {
 export interface IGatewayRouteTargetAllowance {
     host: string;
     ports: number[];
+    /** Allows every port for this host only; it never broadens another host allowance. */
+    allowAnyPort?: boolean;
+}
+/** Public gateway-client policy and lifecycle state. */
+export interface IGatewayClient {
+    id: string;
+    type: TGatewayClientType;
+    name: string;
+    description?: string;
+    /** `*` matches any hostname under a managed zone; `*.zone` matches exactly one label. */
+    hostnamePatterns: string[];
+    allowedRouteTargets: IGatewayRouteTargetAllowance[];
+    capabilities: IGatewayTokenCapabilities;
+    enabled: boolean;
+    tokenCount?: number;
+    /** Generation of the durable live policy document. */
+    policyGeneration: number;
+    createdAt: number;
+    updatedAt: number;
+    createdBy: string;
+}
+/** Complete desired state used for idempotent gateway-client provisioning. */
+export interface IGatewayClientProvisioningSpec {
+    id: string;
+    type: TGatewayClientType;
+    name: string;
+    description?: string;
+    /** `*` matches any hostname under a managed zone; `*.zone` matches exactly one label. */
+    hostnamePatterns: string[];
+    allowedRouteTargets: IGatewayRouteTargetAllowance[];
+    capabilities: IGatewayTokenCapabilities;
+    enabled?: boolean;
 }
+/**
+ * One-time credential material returned after durable token creation.
+ *
+ * Provisioning creates a candidate only. Existing client-bound credentials
+ * remain active until the candidate authenticates the explicit finalization
+ * request, preventing a lost provisioning response from locking out the
+ * gateway client.
+ */
+export interface IGatewayClientCredential {
+    tokenId: string;
+    tokenValue: string;
+    issuedAt: number;
+    state: 'candidate';
+    finalizationRequired: true;
+}
+export type TGatewayClientProvisioningAction = 'created' | 'updated' | 'unchanged';
 /**
  * Resolved auth context for a gateway client token, as reported by the gateway.
  * Scopes are gateway-defined strings; the closed scope list lives in the gateway.
  */
-export interface IGatewayClientContext {
-    role: TGatewayTokenRole;
+interface IGatewayClientContextBase {
     scopes: string[];
-    gatewayClient?: {
-        type: TGatewayClientType;
-        id: string;
-    };
+    /** `*` matches any hostname under a managed zone; `*.zone` matches exactly one label. */
     hostnamePatterns: string[];
     allowedRouteTargets: IGatewayRouteTargetAllowance[];
     capabilities: IGatewayTokenCapabilities;
 }
+/**
+ * Resolved authorization context. A gateway-client role always proves the
+ * concrete credential, bound client, and current live policy generation.
+ * Admin/operator contexts remain unbound for backward compatibility.
+ */
+export type IGatewayClientContext = IGatewayClientContextBase & ({
+    role: 'gatewayClient';
+    credentialId: string;
+    gatewayClient: {
+        type: TGatewayClientType;
+        id: string;
+        policyGeneration: number;
+    };
+} | {
+    role: 'admin' | 'operator';
+    credentialId?: never;
+    gatewayClient?: never;
+});
 /**
  * Where a gateway-managed domain is sourced from.
  *
@@ -260,5 +375,7 @@ export interface IGatewayRouteSyncResult {
     success: boolean;
     action?: 'created' | 'updated' | 'deleted' | 'unchanged';
     routeId?: string;
+    dns?: IGatewayRouteDnsResult;
     message?: string;
 }
+export {};

package/dist_ts/data/settings.d.ts

@@ -11,7 +11,6 @@ export interface ICloudlySettings {
     backupNodeCacheKeepDays?: string;
     dcrouterGatewayUrl?: string;
     dcrouterGatewayApiToken?: string;
-    dcrouterOpsApiToken?: string;
     dcrouterGatewayClientId?: string;
     dcrouterTargetHost?: string;
     dcrouterTargetPort?: string;
@@ -43,7 +42,6 @@ export interface ICloudlySettings {
     scalewayAccessKey?: string;
     scalewaySecretKey?: string;
     scalewayOrganizationId?: string;
-    [key: string]: string | undefined;
 }
 /**
  * Interface for masked settings (used in API responses)

package/dist_ts/requests/gateway.d.ts

@@ -1,5 +1,6 @@
 import * as plugins from '../plugins.js';
-import type { IGatewayCapabilities, IGatewayClientContext, IGatewayClientOwnership, IGatewayClientRoute, IGatewayDnsRecord, IGatewayDomain, IGatewayIdentity, IGatewayRouteConfig, IGatewayRouteSyncResult } from '../data/gateway.js';
+import type { IGatewayCapabilities, IGatewayClient, IGatewayClientCredential, IGatewayClientProvisioningSpec, IGatewayClientContext, IGatewayClientOwnership, IGatewayClientRoute, IGatewayDnsRecord, IGatewayDomain, IGatewayIdentity, IGatewayRouteConfig, IGatewayRouteSyncResult, TGatewayRouteDnsMode, TGatewayClientProvisioningAction } from '../data/gateway.js';
+import type { IMailOverviewDomain, IMailOverviewEmail } from './mail.js';
 /**
  * Gateway client contracts: the machine-facing API a gateway (dcrouter)
  * serves to gateway clients (Onebox, Cloudly/Coreflow).
@@ -31,6 +32,74 @@ export interface IReq_GetGatewayClientContext extends plugins.typedrequestInterf
         capabilities: IGatewayCapabilities;
     };
 }
+/**
+ * Admin-only gateway-client upsert and candidate credential issue.
+ * Provisioning never revokes prior client-bound credentials. The returned
+ * candidate must prove possession through finalizeGatewayClientCredential
+ * before the gateway activates it and revokes superseded siblings.
+ */
+export interface IReq_ProvisionGatewayClientCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ProvisionGatewayClientCredential> {
+    method: 'provisionGatewayClientCredential';
+    request: {
+        /** Admin authentication is intentionally kept at the deployed top level. */
+        identity?: IGatewayIdentity;
+        apiToken?: string;
+        provisioning: IGatewayClientProvisioningSpec;
+        credentialName?: string;
+        expiresInDays?: number | null;
+    };
+    response: {
+        success: true;
+        action: TGatewayClientProvisioningAction;
+        gatewayClient: IGatewayClient;
+        /** One-time, unfinalized credential material returned after durable creation. */
+        credential: IGatewayClientCredential;
+        message?: string;
+    } | {
+        success: false;
+        message: string;
+    };
+}
+/**
+ * Candidate-authenticated completion of a gateway-client credential handover.
+ * The gateway resolves client ownership from the candidate token itself; the
+ * caller cannot select a gateway client or finalize another credential.
+ */
+export interface IReq_FinalizeGatewayClientCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_FinalizeGatewayClientCredential> {
+    method: 'finalizeGatewayClientCredential';
+    request: {
+        /** The one-time candidate token value returned by provisioning. */
+        apiToken: string;
+        /** Must identify the same candidate credential as apiToken. */
+        tokenId: string;
+        /** Admin/operator identities cannot finalize a candidate by substitution. */
+        identity?: never;
+    };
+    response: {
+        success: true;
+        gatewayClientId: string;
+        tokenId: string;
+        revokedCredentialCount: number;
+        finalizedAt: number;
+        message?: string;
+    } | {
+        success: false;
+        message: string;
+    };
+}
+/** Gateway-client-scoped read-only email-domain and recent-email overview. */
+export interface IReq_GetGatewayClientMailOverview extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetGatewayClientMailOverview> {
+    method: 'getGatewayClientMailOverview';
+    request: {
+        identity?: IGatewayIdentity;
+        apiToken?: string;
+        limit?: number;
+    };
+    response: {
+        domains: IMailOverviewDomain[];
+        emails: IMailOverviewEmail[];
+    };
+}
 export interface IReq_GetGatewayClientDomains extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetGatewayClientDomains> {
     method: 'getGatewayClientDomains';
     request: {
@@ -73,6 +142,12 @@ export interface IReq_SyncGatewayClientRoute extends plugins.typedrequestInterfa
         route?: IGatewayRouteConfig;
         enabled?: boolean;
         delete?: boolean;
+        /**
+         * Omission means 'skip' for backward wire compatibility. Reconciliation
+         * claims or replaces exact-host manual A, AAAA, and CNAME records even
+         * when their current value already satisfies the desired address.
+         */
+        dnsMode?: TGatewayRouteDnsMode;
         /**
          * Gateway source profile to bind the route to (by ref or name).
          * Defaults to the gateway's public profile when omitted.

package/dist_ts/requests/mail.d.ts

@@ -216,8 +216,8 @@ export interface IReq_EnqueueMail extends plugins.typedrequestInterfaces.impleme
     };
 }
 /**
- * Cloudly admin UI mail overview, relayed from the hub dcrouter's ops API.
- * Read-only summary: configured email domains and recent queue entries.
+ * Shared read-only mail overview used by the gateway-client API and Cloudly UI:
+ * configured email domains and recent queue entries.
  */
 export interface IMailOverviewDomain {
     domain: string;
@@ -239,7 +239,7 @@ export interface IReq_Any_Cloudly_GetMailOverview extends plugins.typedrequestIn
         identity: IIdentity;
     };
     response: {
-        /** False when no dcrouter ops API token is configured in settings. */
+        /** False when no dcrouter gateway-client credential is configured. */
         configured: boolean;
         gatewayUrl?: string;
         domains: IMailOverviewDomain[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "16.7.0",
+  "version": "17.0.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -156,6 +156,46 @@ The immutable deployment workflow is:
 
 Gateway request contracts include `getGatewayClientRoutes` (`requests.gateway.IReq_GetGatewayClientRoutes`) for listing owned `IGatewayClientRoute[]` route views, and `syncGatewayClientRoute` for idempotently syncing or deleting hostname-owned, routeRef-owned, and combined hostname-plus-routeRef routes. A client can label canonical intent with `managedRouteKind: 'letsencrypt-http01-forward'` and set a higher `priority` for a path-specific HTTP-01 route while retaining a separate normal route for the same hostname. Mail request contracts include `syncMailAddressBinding`, `deleteMailAddressBinding`, `rotateMailCredential`, and `getMailDeliveryStatus`. `IReq_GetMailDeliveryStatus` looks up a delivery spool item by `spoolItemId`, returns `data.IMailDeliveryStatus`, and accepts `IMailSubmissionRequestAuth` so service-mail credentials can query their own accepted, queued, deferred, delivered, or failed status. `TMailAddressBindingSync.outboundEnabled` explicitly controls whether a gateway should maintain a managed outbound SMTP credential for an address binding. Binding credential metadata is public; `rotateMailCredential` returns the new secret only in its one-time `IMailCredentialOneTimeSecret` response.
 
+### Gateway Client Lifecycle and DNS
+
+`syncGatewayClientRoute` accepts an optional `dnsMode`. Omission means `skip` for older clients. `observe` reports DNS without changing it. `reconcile` makes the gateway authoritative for the exact route hostname: it claims or replaces manual A, AAAA, and CNAME records, including already-correct manual values. Its optional `dns` result contains a closed status, retryability, the desired A/AAAA target, overwritten-record evidence, `checkedAt`, and `authoritativeVerifiedAt` once the provider or authoritative server confirms the state. Consumers can carry that evidence while retrying public propagation instead of treating an immediate recursive lookup miss as permanent.
+
+Use `requests.gateway.IReq_ProvisionGatewayClientCredential` to replace an admin/bootstrap token with a first-class gateway-client credential. The admin-authenticated request idempotently upserts a `data.IGatewayClient`, durably creates a new bound credential, returns its raw value once, and then revokes older credentials bound to that client. It never revokes the bootstrap/admin credential. A successful response is discriminated with `success: true` and always includes the action, durable client, one-time credential, and revocation count.
+
+```typescript
+import { requests } from '@serve.zone/interfaces';
+
+const provisioning: requests.gateway.IReq_ProvisionGatewayClientCredential['request'] = {
+  apiToken: 'admin-bootstrap-token',
+  provisioning: {
+    id: 'cloudly-main',
+    type: 'cloudly',
+    name: 'Cloudly main',
+    hostnamePatterns: ['*'],
+    allowedRouteTargets: [
+      {
+        host: 'coretraffic.internal',
+        ports: [],
+        allowAnyPort: true,
+      },
+    ],
+    capabilities: {
+      readDomains: true,
+      readDnsRecords: true,
+      readRoutes: true,
+      syncRoutes: true,
+      syncDnsRecords: true,
+      readMail: true,
+      manageMail: true,
+      readCertificates: true,
+      requestCertificates: true,
+    },
+  },
+};
+```
+
+`getGatewayClientContext` returns effective live policy. A `gatewayClient` role necessarily includes the credential ID, bound client ID/type, and `policyGeneration`; consumers should reject admin/operator or mismatched contexts rather than falling back to a caller-supplied owner ID. `getGatewayClientMailOverview` provides an owner-scoped domain and recent-message summary. Cloudly therefore uses only `dcrouterGatewayApiToken`; the former `dcrouterOpsApiToken` setting is not part of `data.ICloudlySettings`.
+
 Request groups are exported by product area:
 
 - `requests.admin`
@@ -267,7 +307,7 @@ Use of these trademarks must comply with Task Venture Capital GmbH's Trademark G
 
 ### Company Information
 
-Task Venture Capital GmbH
+Task Venture Capital GmbH<br>
 Registered at District Court Bremen HRB 35230 HB, Germany
 
 For any legal inquiries or further information, please contact us via email at hello@task.vc.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '16.7.0',
+  version: '17.0.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/deploymentoperation.ts

@@ -1,4 +1,5 @@
 import type { IDeploymentPreflightProposedConfiguration, IDeploymentPreflightRuntimeTask } from './deploymentpreflight.js';
+import type { IGatewayRouteDnsResult } from './gateway.js';
 import type { IImageRolloutStatus, IImmutableImageDeploymentPlan, TSha256Digest } from './immutableimage.js';
 import { normalizeImmutableReleaseTag, normalizeSha256Digest } from './immutableimage.js';
 import type { IRegistryTarget } from './registry.js';
@@ -342,6 +343,9 @@ interface IDeploymentRouteVerificationEvidenceBase {
   rolloutId: string;
   rolloutGeneration: number;
   expectedDigest: TSha256Digest;
+  gatewayDns?: IGatewayRouteDnsResult;
+  verificationAttemptCount?: number;
+  verificationStartedAt?: number;
 }
 
 export interface IDeploymentRouteVerificationSuccessEvidence

package/ts/data/gateway.ts

@@ -10,6 +10,75 @@ export type TGatewayClientType = 'onebox' | 'cloudly' | 'custom';
  */
 export type TManagedRouteKind = 'letsencrypt-http01-forward';
 
+/**
+ * DNS handling requested alongside a gateway route synchronization.
+ *
+ * - 'reconcile' claims or replaces exact-host manual A, AAAA, and CNAME
+ *   records, including already-correct records, with gateway-managed state.
+ * - 'observe' reports DNS state without mutating it.
+ * - 'skip' bypasses DNS inspection and mutation and is the default when omitted.
+ */
+export type TGatewayRouteDnsMode = 'reconcile' | 'observe' | 'skip';
+
+/**
+ * Detailed DNS outcome reported by a gateway route synchronization.
+ */
+export type TGatewayRouteDnsStatus =
+  | 'not-applicable'
+  | 'skipped'
+  | 'managed-created'
+  | 'managed-updated'
+  | 'managed-overwrote-manual'
+  | 'managed-unchanged'
+  | 'observed-satisfied'
+  | 'managed-deleted'
+  | 'managed-orphan-deleted'
+  | 'record-missing'
+  | 'target-invalid'
+  | 'zone-unmanaged'
+  | 'zone-unavailable'
+  | 'record-conflict'
+  | 'mutation-failed'
+  | 'compensation-failed';
+
+/**
+ * DNS record evidence attached to a gateway route synchronization result.
+ */
+export interface IGatewayRouteDnsRecord {
+  id?: string;
+  type: 'A' | 'AAAA' | 'CNAME';
+  name: string;
+  value: string;
+  ttl: number;
+  proxied?: boolean;
+  managed: boolean;
+}
+
+/**
+ * DNS reconciliation or observation result for a gateway route.
+ */
+export interface IGatewayRouteDnsResult {
+  success: boolean;
+  retryable: boolean;
+  mode: TGatewayRouteDnsMode;
+  status: TGatewayRouteDnsStatus;
+  hostname?: string;
+  targetIp?: string;
+  /** Desired gateway-managed address record type. CNAME appears only in record evidence. */
+  recordType?: 'A' | 'AAAA';
+  zoneId?: string;
+  zoneName?: string;
+  nameservers?: string[];
+  records?: IGatewayRouteDnsRecord[];
+  /** Prior manual records replaced by this reconciliation, preserved as evidence. */
+  overwrittenRecords?: IGatewayRouteDnsRecord[];
+  /** Time at which the gateway checked the DNS state, as Unix epoch milliseconds. */
+  checkedAt: number;
+  /** Time at which authoritative DNS verified the desired state, as Unix epoch milliseconds. */
+  authoritativeVerifiedAt?: number;
+  message?: string;
+}
+
 /**
  * Identity attached to gateway requests. Gateways run their own user/auth
  * domain (e.g. dcrouter operator accounts), so role/type stay open strings;
@@ -70,8 +139,12 @@ export interface IGatewayCapabilities {
 export interface IGatewayTokenCapabilities {
   readDomains?: boolean;
   readDnsRecords?: boolean;
+  readRoutes?: boolean;
   syncRoutes?: boolean;
   syncDnsRecords?: boolean;
+  readMail?: boolean;
+  manageMail?: boolean;
+  readCertificates?: boolean;
   requestCertificates?: boolean;
 }
 
@@ -81,24 +154,94 @@ export interface IGatewayTokenCapabilities {
 export interface IGatewayRouteTargetAllowance {
   host: string;
   ports: number[];
+  /** Allows every port for this host only; it never broadens another host allowance. */
+  allowAnyPort?: boolean;
+}
+
+/** Public gateway-client policy and lifecycle state. */
+export interface IGatewayClient {
+  id: string;
+  type: TGatewayClientType;
+  name: string;
+  description?: string;
+  /** `*` matches any hostname under a managed zone; `*.zone` matches exactly one label. */
+  hostnamePatterns: string[];
+  allowedRouteTargets: IGatewayRouteTargetAllowance[];
+  capabilities: IGatewayTokenCapabilities;
+  enabled: boolean;
+  tokenCount?: number;
+  /** Generation of the durable live policy document. */
+  policyGeneration: number;
+  createdAt: number;
+  updatedAt: number;
+  createdBy: string;
+}
+
+/** Complete desired state used for idempotent gateway-client provisioning. */
+export interface IGatewayClientProvisioningSpec {
+  id: string;
+  type: TGatewayClientType;
+  name: string;
+  description?: string;
+  /** `*` matches any hostname under a managed zone; `*.zone` matches exactly one label. */
+  hostnamePatterns: string[];
+  allowedRouteTargets: IGatewayRouteTargetAllowance[];
+  capabilities: IGatewayTokenCapabilities;
+  enabled?: boolean;
 }
 
+/**
+ * One-time credential material returned after durable token creation.
+ *
+ * Provisioning creates a candidate only. Existing client-bound credentials
+ * remain active until the candidate authenticates the explicit finalization
+ * request, preventing a lost provisioning response from locking out the
+ * gateway client.
+ */
+export interface IGatewayClientCredential {
+  tokenId: string;
+  tokenValue: string;
+  issuedAt: number;
+  state: 'candidate';
+  finalizationRequired: true;
+}
+
+export type TGatewayClientProvisioningAction = 'created' | 'updated' | 'unchanged';
+
 /**
  * Resolved auth context for a gateway client token, as reported by the gateway.
  * Scopes are gateway-defined strings; the closed scope list lives in the gateway.
  */
-export interface IGatewayClientContext {
-  role: TGatewayTokenRole;
+interface IGatewayClientContextBase {
   scopes: string[];
-  gatewayClient?: {
-    type: TGatewayClientType;
-    id: string;
-  };
+  /** `*` matches any hostname under a managed zone; `*.zone` matches exactly one label. */
   hostnamePatterns: string[];
   allowedRouteTargets: IGatewayRouteTargetAllowance[];
   capabilities: IGatewayTokenCapabilities;
 }
 
+/**
+ * Resolved authorization context. A gateway-client role always proves the
+ * concrete credential, bound client, and current live policy generation.
+ * Admin/operator contexts remain unbound for backward compatibility.
+ */
+export type IGatewayClientContext = IGatewayClientContextBase & (
+  | {
+      role: 'gatewayClient';
+      credentialId: string;
+      gatewayClient: {
+        type: TGatewayClientType;
+        id: string;
+        policyGeneration: number;
+      };
+    }
+  | {
+      role: 'admin' | 'operator';
+      credentialId?: never;
+      gatewayClient?: never;
+    }
+);
+
 /**
  * Where a gateway-managed domain is sourced from.
  *
@@ -280,5 +423,6 @@ export interface IGatewayRouteSyncResult {
   success: boolean;
   action?: 'created' | 'updated' | 'deleted' | 'unchanged';
   routeId?: string;
+  dns?: IGatewayRouteDnsResult;
   message?: string;
 }

package/ts/data/settings.ts

@@ -29,7 +29,6 @@ export interface ICloudlySettings {
   // static dcrouterTargetHost (e.g. {"worker-a":"192.0.2.10"}).
   dcrouterGatewayUrl?: string;
   dcrouterGatewayApiToken?: string;
-  dcrouterOpsApiToken?: string;
   dcrouterGatewayClientId?: string;
   dcrouterTargetHost?: string;
   dcrouterTargetPort?: string;
@@ -84,9 +83,6 @@ export interface ICloudlySettings {
   scalewayAccessKey?: string;
   scalewaySecretKey?: string;
   scalewayOrganizationId?: string;
-  
-  // Other settings that might be added in the future
-  [key: string]: string | undefined;
 }
 
 /**

package/ts/requests/gateway.ts

@@ -1,6 +1,9 @@
 import * as plugins from '../plugins.js';
 import type {
   IGatewayCapabilities,
+  IGatewayClient,
+  IGatewayClientCredential,
+  IGatewayClientProvisioningSpec,
   IGatewayClientContext,
   IGatewayClientOwnership,
   IGatewayClientRoute,
@@ -9,7 +12,10 @@ import type {
   IGatewayIdentity,
   IGatewayRouteConfig,
   IGatewayRouteSyncResult,
+  TGatewayRouteDnsMode,
+  TGatewayClientProvisioningAction,
 } from '../data/gateway.js';
+import type { IMailOverviewDomain, IMailOverviewEmail } from './mail.js';
 
 /**
  * Gateway client contracts: the machine-facing API a gateway (dcrouter)
@@ -51,6 +57,90 @@ export interface IReq_GetGatewayClientContext extends plugins.typedrequestInterf
   };
 }
 
+/**
+ * Admin-only gateway-client upsert and candidate credential issue.
+ * Provisioning never revokes prior client-bound credentials. The returned
+ * candidate must prove possession through finalizeGatewayClientCredential
+ * before the gateway activates it and revokes superseded siblings.
+ */
+export interface IReq_ProvisionGatewayClientCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_ProvisionGatewayClientCredential
+> {
+  method: 'provisionGatewayClientCredential';
+  request: {
+    /** Admin authentication is intentionally kept at the deployed top level. */
+    identity?: IGatewayIdentity;
+    apiToken?: string;
+    provisioning: IGatewayClientProvisioningSpec;
+    credentialName?: string;
+    expiresInDays?: number | null;
+  };
+  response:
+    | {
+        success: true;
+        action: TGatewayClientProvisioningAction;
+        gatewayClient: IGatewayClient;
+        /** One-time, unfinalized credential material returned after durable creation. */
+        credential: IGatewayClientCredential;
+        message?: string;
+      }
+    | {
+        success: false;
+        message: string;
+      };
+}
+
+/**
+ * Candidate-authenticated completion of a gateway-client credential handover.
+ * The gateway resolves client ownership from the candidate token itself; the
+ * caller cannot select a gateway client or finalize another credential.
+ */
+export interface IReq_FinalizeGatewayClientCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_FinalizeGatewayClientCredential
+> {
+  method: 'finalizeGatewayClientCredential';
+  request: {
+    /** The one-time candidate token value returned by provisioning. */
+    apiToken: string;
+    /** Must identify the same candidate credential as apiToken. */
+    tokenId: string;
+    /** Admin/operator identities cannot finalize a candidate by substitution. */
+    identity?: never;
+  };
+  response:
+    | {
+        success: true;
+        gatewayClientId: string;
+        tokenId: string;
+        revokedCredentialCount: number;
+        finalizedAt: number;
+        message?: string;
+      }
+    | {
+        success: false;
+        message: string;
+      };
+}
+
+/** Gateway-client-scoped read-only email-domain and recent-email overview. */
+export interface IReq_GetGatewayClientMailOverview extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_GetGatewayClientMailOverview
+> {
+  method: 'getGatewayClientMailOverview';
+  request: {
+    identity?: IGatewayIdentity;
+    apiToken?: string;
+    limit?: number;
+  };
+  response: {
+    domains: IMailOverviewDomain[];
+    emails: IMailOverviewEmail[];
+  };
+}
+
 export interface IReq_GetGatewayClientDomains extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
   IReq_GetGatewayClientDomains
@@ -108,6 +198,12 @@ export interface IReq_SyncGatewayClientRoute extends plugins.typedrequestInterfa
     route?: IGatewayRouteConfig;
     enabled?: boolean;
     delete?: boolean;
+    /**
+     * Omission means 'skip' for backward wire compatibility. Reconciliation
+     * claims or replaces exact-host manual A, AAAA, and CNAME records even
+     * when their current value already satisfies the desired address.
+     */
+    dnsMode?: TGatewayRouteDnsMode;
     /**
      * Gateway source profile to bind the route to (by ref or name).
      * Defaults to the gateway's public profile when omitted.

package/ts/requests/mail.ts

@@ -310,8 +310,8 @@ export interface IReq_EnqueueMail extends plugins.typedrequestInterfaces.impleme
 }
 
 /**
- * Cloudly admin UI mail overview, relayed from the hub dcrouter's ops API.
- * Read-only summary: configured email domains and recent queue entries.
+ * Shared read-only mail overview used by the gateway-client API and Cloudly UI:
+ * configured email domains and recent queue entries.
  */
 export interface IMailOverviewDomain {
   domain: string;
@@ -338,7 +338,7 @@ export interface IReq_Any_Cloudly_GetMailOverview extends plugins.typedrequestIn
     identity: IIdentity;
   };
   response: {
-    /** False when no dcrouter ops API token is configured in settings. */
+    /** False when no dcrouter gateway-client credential is configured. */
     configured: boolean;
     gatewayUrl?: string;
     domains: IMailOverviewDomain[];